1. Field of the Invention
The present invention relates to secure proxy signing devices for forming and supplying digital signatures over a network on behalf of users so that private keys are never extant at user equipment which is not secure, and to methods of using, and systems employing, such devices.
2. Description of the Related Art
Digital signatures are generally produced by encrypting a hash of a document with the private key of a public key/private key pair unique to the user (generated e.g. by RSA or El Gamal algorithms) to manifest the user""s approval of the document. The term xe2x80x9cdocumentxe2x80x9d is used throughout this application to indicate or include any digital data, program, or file or a plurality or combination thereof. A hash is produced by applying a secure hash function (such as SHA-1 or RIPEMD) to reduce such data to a bit string of a fixed predetermined length (e.g. 160 bits if SHA-1 is used). A person having both a document and an associated digital signature can verify these items by comparing the result of decrypting the digital signature using the public key of the user with the result of hashing the document using the secure hash function. Such verification depends on the assumption that the private key is secret and is only known or used by or on behalf of the user. Yet if a private key is stored or even temporarily extant at user equipment such as a personal computer connected to an insecure network such as the Internet, there is the risk that a malicious program could be planted in the PC which would extract keys and send them over the network to an unscrupulous person.
To avoid this risk, it has been proposed to form the digital signature in a user""s smartcard placed in a smartcard reader associated with the user""s equipment. The smartcard is a secure proxy signing device because it uses a private key which never leaves the card. However, a hash of the document to be signed has to be presented to the smartcard in order for the smartcard to form the digital signature. This need to present the document hash to the smartcard raises the risk, particularly in systems where there is an insecure link between the process in which the hash is generated and the smartcard, that a phony document hash could be presented to the smartcard by an impersonator for signature on behalf of a user.
For example, if the document hash is generated by a Java (a trademark of Sun Microsystems Inc.) applet running on user equipment under a browser, such an applet process cannot access local disks or local I/O. Therefore, the smartcard reader cannot be accessed directly from the applet process, and consequently, communication between the applet process and a background process communicating with the smartcard must take place by server echoing via the insecure network. Such communication would thereby be exposed to an eavesdropper monitoring the insecure network, and the smartcard would be vulnerable to being spoofed by presentation to it of a phony document hash, for example in a block replay attack where previous authentic communications to the smartcard, or portions thereof, are replayed.
Another approach to avoiding the risk of key extraction from insecure user equipment is described in U.S. Pat. No. 5,208,858 wherein the private keys of all users are stored and maintained at a server functioning as a proxy signing device. Therein, a hash of the approved document is sent from the user equipment to the server via the network. At the server, the received hash is encrypted with the user""s private key available at the server to form a digital signature which is combined with the user""s public key and further data to form a so-called certificate which is transmitted to the user equipment for checking. At the user equipment, the result of decrypting the signature with the user""s public key is compared with the document hash which was sent. If the compared items are the same, the document and the signature-containing certificate may be sent directly from the user equipment to the desired recipients.
The method of U.S. Pat. No. 5,208,858 has the drawback of the need to send the digital signature back to the originator for checking and also that the server must be located in a highly secure place because the private keys are stored therein in the clear (or at least in a form from which they can be derived by the server). It should be noted that the consequences of a person of malevolent intent compromising the server and obtaining the stored private keys are catastrophic, potentially rendering unreliable all digital signatures made with the system at any time. Further, in this known method it appears that the server could be tricked by a block-replay attack or a man-in-the middle attack into signing a document which did not originate from the user on behalf of whom the signature is sought, or signing unauthorized duplicates of authentic documents.
It is a general object of the present invention to provide a secure proxy signing device, and a system and method for using such a device, to form digital signatures which are supplied over an insecure network, such as the Internet, which provides security measures directed against the possibility that the proxy signing device is presented by an impersonator of the user with an unauthentic document hash for signature via the network. It is a further object of the present invention that the security measures guard against block-replay and man-in-the-middle attacks.
Briefly, the aforementioned and other objects are satisfied by providing a proxy signing device for forming a digital signature of a document using a private key stored within the signing device and data items supplied to the signing device from which a hash of the document is derived and authenticated by means within the signing device. Said signing device further comprises means for encrypting the document hash with the private key to form the digital signature only if the document hash has been authenticated. The invention is further characterized in that said means for deriving and authenticating the document hash is configured for authenticating a derived document hash on a condition that first data derived at least in part from one of said data items is the same as second data equal to or derived from another of said data items.
More particularly, the proxy signing device comprises a random number generator, and the first data is derived from a combination of the derived document hash, a number stored in the proxy signing device which was previously generated by the random number generator and communicated to the signing device, and user identifying data stored in the signing device and only obtainable at the user equipment by interaction with a physically present user, such as a password or passphrase entered by the user or biometric data (hash of a fingerprint, voiceprint, retina scan, or face scan) measured or scanned from the physically present user.
By providing for authentication in the proxy signing device and by making one of the plural data items provided to the signing device depend on a random number previously generated by the signing device solely for use in conjunction with obtaining the current digital signature, high immunity is provided against the signing device being spoofed by a block replay of presentations of variations of previous communications with the signing device, or by a man-in-the-middle attack. Further, the use in the authentication process of user identifying data which could only have been obtained by interaction with a physically present user at the user equipment provides high immunity against impersonation of the user.
Also, in accordance with the present invention, user apparatus is provided for cooperating with a proxy signing device via a communication path including a network for forming a digital signature of a user to whom is assigned a private key/public key. The user apparatus comprises user interaction means for a user to indicate approval of a document, computation means configured for forming first and second data items to be provided to the signing device via the communication path, said first data item being derived from a hash of the approved document, and said second data item being derived from a combination including said hash of the approved document and a random number computed by the signing device. The apparatus is also characterized in that the user interaction means is further configured for obtaining user identifying information from the user (password or passphrase or biometric information such as fingerprint, voiceprint, retina scan, face scan) and in that the combination from which the second data item is derived further comprises user identifying data derived from the obtained user identifying information. Also, the second data item is derived from said combination by hashing together the items of said combination.
The present invention also comprises a method for forming and supplying a digital signature of a user of a document comprising generating a random number in a signing device, supplying the random number to user equipment, and forming in the user equipment a first data item derived from a hash of the document and a second data item derived from a combination including said hash of the document and said random number. The inventive method further comprises authenticating in the signing device a hash of the document derived from said first data item if data derived by the signing device from the combination including the derived hash of the approved document and a previously generated random number stored in the signing device equals data derived from said second data item, and if the derived document hash is authenticated, encrypting the derived document hash in the signing device with a private key of the user stored in the signing device and sending the digital signature from the signing device via the network to a recipient device. Another aspect of the inventive method is that user identifying data which is derived from user identifying information obtained from a user physically present at the user equipment forms part of the combination from which the second data is derived, and that the user identifying information is stored in the signing device and used by it in the authentication process.
Other objects, features and advantages of the present invention will become apparent upon perusal of the following detailed description when taken in conjunction with the appended drawing, wherein: